﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="The !irpfind extension displays information about all I/O request packets (IRP) currently allocated in the target system, or about those IRPs matching the specified search criteria."/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>!irpfind</title>

<meta name="MS-HAID" content="r27_exts_kernel_E_f937a896-8b86-463a-8bfc-24af6b7181cc.xml"/>


<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(2367);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/_irpfind.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="_irp.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="_irpzone.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="debugger_reference.htm">Debugger Reference</A> &gt; <A href="debugger_commands.htm">Debugger Commands</A> &gt; <A href="kernel_mode_extensions.htm">Kernel-Mode Extension Commands</A> &gt; </div>
	<div id="winchm_template_title">!irpfind</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>The <b>!irpfind</b> extension displays information about all I/O request packets (IRP) currently allocated in the target system, or about those IRPs matching the specified search criteria.</p>
<p>Syntax</p>
<pre class="syntax"><b>!irpfind </b>[<b>-v</b>][<i>PoolType</i>[<i>RestartAddress</i>[<i>Criteria</i><i>Data</i>]]]</pre>
<h2><a id="ddk__irpfind_dbg"></a><a id="DDK__IRPFIND_DBG"></a>Parameters</h2>
<p></p>
<dl>
<dt><a id="_______-v______"></a><a id="_______-V______"></a>       <b>-v</b>      </dt>
<dd>
<p>Displays verbose information. </p>
</dd>
<dt><a id="_______PoolType______"></a><a id="_______pooltype______"></a><a id="_______POOLTYPE______"></a>       <i>PoolType</i>      </dt>
<dd>
<p>Specifies the type of pool to be searched. The following values are permitted:</p>
<p></p>
<dl>
<dt><a id="0"></a>0</dt>
<dd>
<p>Specifies nonpaged memory pool. This is the default.</p>
</dd>
<dt><a id="1"></a>1</dt>
<dd>
<p>Specifies paged memory pool.</p>
</dd>
<dt><a id="2"></a>2</dt>
<dd>
<p>Specifies the special pool.  </p>
</dd>
<dt><a id="4"></a>4</dt>
<dd>
<p>  Specifies the session pool.</p>
</dd>
</dl>
</dd>
<dt><a id="_______RestartAddress______"></a><a id="_______restartaddress______"></a><a id="_______RESTARTADDRESS______"></a>       <i>RestartAddress</i>      </dt>
<dd>
<p>Specifies the hexadecimal address at which to begin the search. This is useful if the previous search was terminated prematurely. The default is zero.</p>
</dd>
<dt><a id="_______Criteria______"></a><a id="_______criteria______"></a><a id="_______CRITERIA______"></a>       <i>Criteria</i>      </dt>
<dd>
<p>Specifies the criteria for the search. Only those IRPs that satisfy the given match will be displayed.</p>
<table>
<tr>
<th>Criteria</th>
<th>Match</th>
</tr>
<tr>
<td>
<p><b>arg</b></p>
</td>
<td>
<p>Finds all IRPs with a stack location where one of the arguments equals <i>Data</i>.  </p>
</td>
</tr>
<tr>
<td>
<p><b>device</b></p>
</td>
<td>
<p>Finds all IRPs with a stack location where <b>DeviceObject</b> equals <i>Data</i>.</p>
</td>
</tr>
<tr>
<td>
<p><b>fileobject</b></p>
</td>
<td>
<p>Finds all IRPs whose <b>Irp.Tail.Overlay.OriginalFileObject</b> equals <i>Data</i>.</p>
</td>
</tr>
<tr>
<td>
<p><b>mdlprocess</b></p>
</td>
<td>
<p>Finds all IRPs whose <b>Irp.MdlAddress.Process</b> equals <i>Data</i>.</p>
</td>
</tr>
<tr>
<td>
<p><b>thread</b></p>
</td>
<td>
<p>Finds all IRPs whose <b>Irp.Tail.Overlay.Thread</b> equals <i>Data</i>.</p>
</td>
</tr>
<tr>
<td>
<p><b>userevent</b></p>
</td>
<td>
<p>Finds all IRPs whose <b>Irp.UserEvent</b> equals <i>Data</i>.</p>
</td>
</tr>
</table>
<p> </p>
</dd>
<dt><a id="_______Data______"></a><a id="_______data______"></a><a id="_______DATA______"></a>       <i>Data</i>      </dt>
<dd>
<p>Specifies the data to be matched in the search.</p>
</dd>
</dl>
<h3><a id="DLL"></a><a id="dll"></a>DLL</h3>
<p>
          Kdexts.dll</p>
<h3><a id="Additional_Information"></a><a id="additional_information"></a><a id="ADDITIONAL_INFORMATION"></a>Additional Information</h3>
<p>See <a href="#Bookmark1479">Plug and Play Debugging</a> for applications of this extension command. For information about IRPs, see the Windows Driver Kit (WDK) documentation and <i>Microsoft Windows Internals</i> by Mark Russinovich and David Solomon. </p>
<h2>Remarks</h2>
<p>This example finds the IRP in the nonpaged pool that is going to set user event FF9E4F48 upon completion:</p>
<pre class="syntax" xml:space="preserve"><code>kd&gt; !irpfind 0 0 userevent ff9e4f48</code></pre>
<p>The following example produces a full listing of all IRPs in the nonpaged pool:</p>
<pre class="syntax" xml:space="preserve"><code>kd&gt; !irpfind
Searching NonPaged pool (8090c000 : 8131e000) for Tag: Irp
8097c008 Thread 8094d900 current stack belongs to  \Driver\symc810
8097dec8 Thread 8094dda0 current stack belongs to  \FileSystem\Ntfs
809861a8 Thread 8094dda0 current stack belongs to  \Driver\symc810
809864e8 Thread 80951ba0 current stack belongs to  \Driver\Mouclass
80986608 Thread 80951ba0 current stack belongs to  \Driver\Kbdclass
80986728 Thread 8094dda0 current stack belongs to  \Driver\symc810</code></pre></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
